SECURITY FLAWS IN A CARMAKER'S WEB PORTAL LET ONE HACKER REMOTELY UNLOCK CARS FROM ANYWHERE

Summary from the TLDR InfoSec newsletter

Security researcher Eaton Zveare found a vulnerability in a carmaker's web portal that let him create an admin account with full access. He could access customers' personal and financial data, track vehicles, and enroll customers in features to control some car functions remotely. During testing, Zveare remotely unlocked and took control of a friend's vehicle.